Generate attack discoveries from alerts

Base URL
https://{kibana_url}
  • POST /api/attack_discovery/_generate
  • POST /s/{space_id}/api/attack_discovery/_generate
Auth

Initiates the generation of attack discoveries by analyzing security alerts using AI. Returns an execution UUID that can be used to track the generation progress and retrieve results. Results may also be retrieved via the find endpoint.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Request body

alertsIndexPattern string required

The (space specific) index pattern that contains the alerts to use as context for the attack discovery. Example: .alerts-security.alerts-default

anonymizationFields object[] required

The list of fields, and whether or not they are anonymized, allowed to be sent to LLMs. Consider using the output of the /api/security_ai_assistant/anonymization_fields/_find API (for a specific Kibana space) to provide this value.

allowed boolean

Whether this field is allowed to be sent to the model.

anonymized boolean

Whether this field should be anonymized.

createdAt string

Timestamp of when the anonymization field was created.

createdBy string

Username of the person who created the anonymization field.

field string required

Name of the anonymization field.

id string · format: nonempty · min length: 1 required

A string that does not contain only whitespace characters.

namespace string

Kibana space in which this anonymization field exists.

timestamp string · format: nonempty · min length: 1

A string that represents a timestamp in ISO 8601 format and does not contain only whitespace characters.

updatedAt string

Timestamp of the last update.

updatedBy string

Username of the person who last updated the field.

apiConfig object required
actionTypeId string required

Action type ID

connectorId string required

Connector ID

defaultSystemPromptId string

Default system prompt ID

model string

Model

provider enum

Provider

Values: OpenAI Azure OpenAI Other
connectorName string
end string
filter object

An Elasticsearch-style query DSL object used to filter alerts. For example:

  "filter": {
    "bool": {
      "must": [],
      "filter": [
        {
          "bool": {
            "should": [
              {
                "term": {
                  "user.name": { "value": "james" }
                }
              }
            ],
            "minimum_should_match": 1
          }
        }
      ],
      "should": [],
      "must_not": []
    }
  }
} ```
model string
replacements map string to string

Replacements object used to anonymize/deanonymize messages

size number required
start string
subAction enum required
Values: invokeAI invokeStream

Responses

Indicates a successful call.

application/json
execution_uuid string · format: nonempty · min length: 1 required

A string that does not contain only whitespace characters.

Bad Request response.

application/json
error string required

Error type

message string required

Human-readable error message describing what went wrong

status_code number required

HTTP status code

Base URL
https://{kibana_url}